commit: Sync main with develop - Infrastructure & DevOps Modernization

[thetechgy]

This comprehensive update brings main branch to parity with develop,
introducing significant improvements to the repository's development,
testing, and operational infrastructure.

🔧 Major Changes:

1. DEVELOPMENT ENVIRONMENT

   • Added VS Code devcontainer (Wolfi-based, PowerShell 7.5.4)
   • Codex policy configuration (.codex/) with strict sandboxing
   • Hardened Docker runtime with non-root user (vscode)
   • AI tooling support (Codex, Claude) with optional disable flag

2. CI/CD PIPELINE OVERHAUL

   • Replaced legacy ci-cd-pipeline.yml with new ci.yml
   • PSScriptAnalyzer analysis job (Ubuntu 24.04)
   • Dual Pester test jobs: Windows PowerShell 5.1 + PowerShell 7
   • Added Dependency Review workflow (supply-chain security)
   • Added OSSF Scorecard for security posture tracking

3. CODE QUALITY & STANDARDS

   • PSScriptAnalyzerSettings.psd1: New comprehensive policy
     • Enforces PS 5.1 + PS 7 compatibility
     • Security rules (no Invoke-Expression, no plaintext secrets)
     • Team consistency (indentation, casing, cmdlet usage)
   • Updated .editorconfig with granular per-filetype rules
   • Enhanced .gitattributes for cross-platform consistency

4. CONFIGURATION MANAGEMENT

   • Updated Dependabot to GitHub Actions ecosystem (from NuGet)
   • Weekly schedule (Mondays, 9 AM EST) with PR grouping
   • Added CODEOWNERS for .github/ approval routing

5. REPOSITORY META

   • Refreshed .gitignore (Pester output, test results, .env files)
   • Updated .markdownlint.jsonc for flexible markdown linting
   • Streamlined VS Code settings and extension recommendations
   • Removed legacy ArchiTechLabs-Script-Hub.code-workspace

6. DOCUMENTATION

   • Added .devcontainer/README.md (172 lines of guidance)
   • Updated main README.md with CI/Dependabot/PowerShell badges

✨ Benefits:

• Consistent tooling across dev and CI environments
• Strong isolation boundaries via strict Codex policies
• Cross-platform test coverage (Windows PS 5.1 & 7)
• Reduced security risk with sandboxing and dependency scanning
• Faster onboarding with devcontainer automation
• Transparent code quality via GitHub Actions artifacts

🔒 Security Enhancements:

• Hardened devcontainer runtime (cap-drop=ALL, no-new-privileges)
• Restricted Codex execution model (untrusted, workspace-write)
• Dependency Review for vulnerable package detection
• OSSF Scorecard for supply-chain posture

⚠️ Migration Notes:

• CI now runs on develop + main branches (not just main)
• Pester test paths: modules//Tests and scripts//Tests
• PSScriptAnalyzer uses repo-managed settings file
• Ignore noisy log messages from devcontainer startup (harmless)

BREAKING CHANGES: None for end users. Legacy ci-cd-pipeline.yml removed.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out
the documentation.